Hello! I am on Splunk 8.1.3 and I am attempting to use this JavaScript code to remove ALL from my multiselect. While on the component side, it does exactly as advertised and removes ALL from the multiselect component when something else is selected, Splunk itself does not appear to be honoring the update to the token. I.e., if my multi-select for a token called TOKEN_NAME starts as ALL then changes to item1, item2, the multi-select component works beautifully. Additionally, form.TOKEN_NAME in the URL shows the correct values, as I expected. The problem is, the part of my dashboard that uses the token never seems to register that the token was updated and still uses the originally ALL value. I can't post my exact dashboard, but it is something similar to: <form script="removeALLfromMultiselect.js">
<label>Example</label>
<fieldset submitButton="false" autoRun="true"/>
<input type="time" token="timeRange">
<label>Time Range</label>
<default>
<earliest>-12h@now</earliest>
<latest>now</latest>
</default>
</input>
<input type="multiselect" token="TOKEN_NAME" searchWhenChanged="true">
<label>Filter</label>
<fieldForLabel>item</fieldForLabel>
<fieldForValue>item</fieldForValue>
<search>
<query>sourcetype=SOURCE item | dedup item</query>
<earliest>-24h@now</earliest>
<latest>now</latest>
</search>
<choice value="*">ALL</choice>
<default>*</default>
<initialValue>*</initialValue>
<allowCustomValues>true</allowCustomValues>
<valuePrefix>item="*</valuePrefix>
<valueSuffix>*"</valueSuffix>
<delimiter> OR </delimiter>
</input>
</fieldeset>
<row>
<panel>
<title>Graph</title>
<chart>
<search>
<query>sourcetype=SOURCE $TOKEN_NAME$ ... (some more query stuff)</query>
<earliest>$timeRange.earliest$</earliest>
<latest>$timeRange.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.axisTitleX.visibility">collapsed</option>
<option name="charting.axisTitleY.visibility">collapsed</option>
<option name="charting.axisTitleY2.visibility">collapsed</option>
<option name="charting.chart">line</option>
<option name="charting.chart.nullValueMode">zero</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.mode">standard</option>
<option name="charting.legend.placement">none</option>
<option name="charting.height">862</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">true</option>
<option name="trellis.scales.shared">0</option>
<option name="trellis.size">medium</option>
</chart>
</panel>
</row>
</form> If I update the multiselect, the multiselect changes, the URL changes, the dashboard refreshes, but the chart does not use the right query. If I click the Open in Search button below the chart component, I can see the Search it is using is the wrong value for $TOKEN_NAME$, it is still using 'item="***"' for ALL. Is there something here I am missing? I'd appreciate any help anyone can provide.
... View more
